Call runRead, not runWrite

SecurityXmlUserManager getUserRoles and searchUsers are read-based
methods, but are calling runWrite to run their actions. Acquiring a
write lock for these operations is unnecessary. They should be calling
runRead
Merge pull request #30 from sonatype/security-concurrency-bug

REVIEW: Call runRead, not runWrite